If the application detects a message which is supposed to be deleted according to the configured security settings, it does not permanently delete it straight away. Instead, it moves it to a specially set up hidden folder of the corresponding mailbox. This temporary storage is conditionally referred to as backup.
On the one hand, this behavior prevents the risk of immediate infection. On the other hand, it allows the Administrator to review all the security violations detected by the application and, if necessary, to locate and release selected items.
Every message moved to backup is registered as a separate backup item and displayed in the Backup section of the Management Console. You can manage backup items as follows:
Additionally, you can use the Backup view to locate and manage messages originally stored in Exchange Online quarantine. The application requests the details of the quarantined messages from Exchange Online and displays them along with the backup items of Kaspersky Security. You can apply the same actions to Exchange Online quarantined messages as to Kaspersky Security backup items, except for saving them to disk.
By default, displaying Exchange Online quarantined items in the Management Console is enabled. To disable it, remove the corresponding filter in the Storage column of the Backup view.
The application does not move messages from Exchange Online to Kaspersky Security for Microsoft Office 365 infrastructure, nor does it perform any actions on them on its own. If any action on such messages is requested by the user, the application contacts Exchange Online and forces it to proceed with the corresponding operation.
If you want the application to access Exchange Online quarantined messages, make sure that the Service Account is granted the Security Admin role.
The retention period for messages moved to backup by Kaspersky Security for Microsoft Office 365 is 30 days. After this period is over, the messages and their metadata are permanently deleted.
The retention period for Exchange Online quarantined messages is defined by the corresponding Exchange Online settings.